freeipa

#9495 ipa-getkeytab does not support KRB5_CLIENT_KTNAME
Opened by cheimes. Modified

Open
Close Issue

Issue

The GSSAPI environment variable KRB5_CLIENT_KTNAME can be used to automatically acquire or refresh a TGT from a client keytab. GSSAPI-aware application such as IPA client tools (via python-gssapi) and OpenLDAP client tools support this. However this convenient trick does not work with ipa-getkeytab. I think it's failing, because the tool uses low-level KRB5 API instead of GSSAPI, https://github.com/freeipa/freeipa/blob/release-4-11-0/client/ipa-getkeytab.c#L1188 .

Steps to Reproduce

# klist
klist: Credentials cache 'KCM:0' not found
# KRB5_CLIENT_KTNAME=/etc/krb5.keytab ipa service-add myservice/$(hostname)
------------------------------------------------------------------------------------------------------------
Added service "myservice/host.ipa.example@IPA.TEST"
------------------------------------------------------------------------------------------------------------
  Principal name: myservice/host.ipa.example@IPA.TEST
  Principal alias: myservice/host.ipa.example@IPA.TEST
  Managed by: host.ipa.example
# klist
Ticket cache: KCM:0:40327
Default principal: host/host.ipa.example@IPA.TEST
Valid starting       Expires              Service principal
12/07/2023 13:04:59  12/08/2023 12:07:00  HTTP/server.IPA.TEST@IPA.TEST
12/07/2023 13:04:58  12/08/2023 12:07:00  krbtgt/IPA.TEST@IPA.TEST

# kdestroy -A
# KRB5_CLIENT_KTNAME=/etc/krb5.keytab ipa-getkeytab -k /etc/myservice.keytab -p myservice/$(hostname)
Kerberos User Principal not found. Do you have a valid Credential Cache?

# kinit -kt /etc/krb5.keytab 
# ipa-getkeytab -k /etc/myservice.keytab -p myservice/$(hostname)
Keytab successfully retrieved and stored in: /etc/myservice.keytab

Actual behavior

KRB5_CLIENT_KTNAME=/etc/krb5.keytab ipa-getkeytab fails with Kerberos User Principal not found. Do you have a valid Credential Cache? instead of automatically acquiring a ccache with the client keytab from KRB5_CLIENT_KTNAME.

Expected behavior

ipa-getkeytab should support automatic ticket acquisition with client keytab.

Version/Release/Distribution

ipa-client-4.10.2-4.el9_3.1.x86_64

Additional info:

Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.